Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

G4jZEW68K1.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.051732200697524
Filename:	G4jZEW68K1.exe
Filesize:	313767
MD5:	caadab8341e6460bf472806fb5f4396d
SHA1:	ed3ad1338f98090aba0ef3e9a2f6ea979f1c6565
SHA256:	b7abfce92efecdb6b034b4474668dc7cc08aaf7a8b6490fd3eb0fb5506024577
SHA512:	bbe2fe8082d40109d807846f5d01d27eb3dd4bf7136d14d0c247262b340fff8a3fef3bf22aaa9a173ce78425566db059857a6983d6c4943faef28a6a5e0228ff
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Security Software Discovery
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)	Malware Analysis System Evasion
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Security Software Discovery
Tries to steal Crypto Currency Wallets	Stealing of Sensitive Information	Data from Local System
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp Security Software Discovery
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Security Software Discovery Archive Collected Data Encrypted Channel
Drops certificate files (DER)	E-Banking Fraud
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Security Software Discovery System Information Discovery
Sample file is different than original file name gathered from version info	System Summary	Security Software Discovery
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary	Security Software Discovery
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary	Windows Management Instrumentation
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking	Security Software Discovery
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\Public\Desktop\Google Chrome.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:54 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide

dropped

Details

File:	C:\Users\Public\Desktop\Google Chrome.lnk
Category:	dropped
Dump:	Google Chrome.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\G4jZEW68K1.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:54 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Entropy:	3.4465908111784267
Encrypted:	false
Ssdeep:	48:8SyIl2dfTXd3RYrnvPdAKRkdAGdAKRFdAKRE:8S7lOw
Size:	2104
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\G4jZEW68K1.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\G4jZEW68K1.exe.log
Category:	dropped
Dump:	G4jZEW68K1.exe.log.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\G4jZEW68K1.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3318368586986695
Encrypted:	false
Ssdeep:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
Size:	3274
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\Tmp1F99.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp1F99.tmp
Category:	dropped
Dump:	Tmp1F99.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\G4jZEW68K1.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\Tmp1FAA.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp1FAA.tmp
Category:	dropped
Dump:	Tmp1FAA.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\G4jZEW68K1.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
Category:	dropped
Dump:	76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\G4jZEW68K1.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	2251
Whitelisted:	true
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\G4jZEW68K1.exe

"C:\Users\user\Desktop\G4jZEW68K1.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3012
Target ID:	0
Parent PID:	1028
Name:	G4jZEW68K1.exe
Path:	C:\Users\user\Desktop\G4jZEW68K1.exe
Commandline:	"C:\Users\user\Desktop\G4jZEW68K1.exe"
Size:	313767
MD5:	CAADAB8341E6460BF472806FB5F4396D
Time:	16:36:54
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x480000
Modulesize:	335872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

https://duckduckgo.com/ac/?q=

unknown

http://tempuri.org/Entity/Id14ResponseD

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

http://tempuri.org/Entity/Id6ResponseD

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id4

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://tempuri.org/Entity/Id19Response

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id13ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://tempuri.org/Entity/Id5ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel

unknown

http://tempuri.org/Entity/Id9Response

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://tempuri.org/Entity/Id20

unknown

http://tempuri.org/Entity/Id21

unknown

http://tempuri.org/Entity/Id22

unknown

http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1

unknown

http://tempuri.org/Entity/Id23

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1

unknown

http://tempuri.org/Entity/Id24

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue

unknown

http://tempuri.org/Entity/Id24Response

unknown

https://www.ecosia.org/newtab/

unknown

http://tempuri.org/Entity/Id1Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey

unknown

http://tempuri.org/Entity/Id21ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust

unknown

http://tempuri.org/Entity/Id10

unknown

http://tempuri.org/Entity/Id11

unknown

http://tempuri.org/Entity/Id10ResponseD

unknown

http://tempuri.org/Entity/Id12

unknown

http://tempuri.org/Entity/Id16Response

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel

unknown

http://tempuri.org/Entity/Id13

unknown

http://tempuri.org/Entity/Id14

unknown

http://tempuri.org/Entity/Id15

unknown

http://tempuri.org/Entity/Id16

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce

unknown

http://tempuri.org/Entity/Id17

unknown

http://tempuri.org/Entity/Id18

unknown

http://tempuri.org/Entity/Id5Response

unknown

http://tempuri.org/Entity/Id19

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id15ResponseD

unknown

http://tempuri.org/Entity/Id10Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Renew

unknown

http://tempuri.org/Entity/Id11ResponseD

unknown

http://tempuri.org/Entity/Id8Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT

unknown

http://schemas.xmlsoap.org/ws/2006/02/addressingidentity

unknown

http://tempuri.org/Entity/Id17ResponseD

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://tempuri.org/Entity/Id8ResponseD

unknown

There are 90 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

103.113.70.99

unknown

India

Details

IP:	103.113.70.99
TargetID:	0
Current Path:	C:\Users\user\Desktop\G4jZEW68K1.exe
Country:	India
Countrycode:	IND
ASN number:	133973
ASN name:	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064

Blob

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Value name:	Blob
Value data:	0B 00 00 00 01 00 00 00 48 00 00 00 54 00 69 00 74 00 61 00 6E 00 69 00 75 00 6D 00 20 00 52 00 6F 00 6F 00 74 00 20 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 00 00 02 00 00 00 01 00 00 00 CC 00 00 00 1C 00 00 00 6C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7B 00 34 00 31 00 37 00 34 00 34 00 42 00 45 00 34 00 2D 00 31 00 31 00 43 00 35 00 2D 00 34 00 39 00 34 00 43 00 2D 00 41 00 32 00 31 00 33 00 2D 00 42 00 41 00 30 00 43 00 45 00 39 00 34 00 34 00 39 00 33 00 38 00 45 00 7D 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 45 00 6E 00 68 00 61 00 6E 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6F 00 67 00 72 00 61 00 70 00 68 00 69 00 63 00 20 00 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 20 00 76 00 31 00 2E 00 30 00 00 00 00 00 03 00 00 00 01 00 00 00 14 00 00 00 F1 A5 78 C4 CB 5D E7 9A 37 08 93 98 3F D4 DA 8B 67 B2 B0 64 20 00 00 00 01 00 00 00 0A 03 00 00 30 82 03 06 30 82 01 EE A0 03 02 01 02 02 08 67 F7 BE B9 6A 4C 27 98 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 1E 17 0D 32 33 30 33 31 34 31 30 33 35 32 30 5A 17 0D 32 36 30 36 31 37 31 30 33 35 32 30 5A 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 86 E4 57 7A 58 61 CE 81 91 77 D0 05 FA 51 D5 51 5A 93 6C 61 0C CF CB DE 53 32 CD 15 1D A6 47 EE 88 1A 24 5C 9B 02 83 3B 02 AF 3D 76 FE 20 BD 3B FA F7 A2 09 73 E7 2E BD 94 40 D0 9D 8C 3D 27 13 BD F0 D0 9F EB 95 32 AC D7 A4 2D A2 A9 52 DA A8 6A 2A 88 EE 42 7D 30 95 9D 90 BF BA 05 27 6A A0 29 98 A6 98 6F C0 13 06 62 9B 79 B8 40 5D 1F 1F A6 D9 A4 2F 82 7A FC 75 66 34 0D C2 DE 27 01 2B 94 BB 4A 27 B3 CB 1C 21 9A 3C B2 C1 42 03 F3 44 51 BD 62 65 20 ED D4 DB CC 41 4F 59 3F 2A CB C4 84 79 F7 14 3C BE 13 9C FD 12 9C 91 3E 53 03 DC 20 F9 4C 44 35 89 01 B6 9A 84 8D 7E A0 2E 30 8A 31 15 60 AC 00 AE 00 9A 29 10 9A EE D9 71 3D D8 91 9B 97 ED 59 80 58 E1 7F 07 26 C7 A0 20 F7 10 AB C0 62 91 DF AA F1 81 C6 BE 6A 76 C8 9C B6 8E B0 B0 EC 1C D9 5F 32 6C 7E 55 58 8B FD 76 C5 19 02 03 01 00 01 A3 28 30 26 30 13 06 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 03 82 01 01 00 70 85 12 93 D7 57 E9 82 79 7D C5 F7 F2 7D A8 94 EF 0C DB 32 9F 06 A6 09 6E 0C F6 04 B0 E5 47 11 56 0E F4 0F 52 82 08 2E 21 0F 55 A3 DB 41 F3 12 54 8B 76 11 F5 F0 DA CE A3 C7 8B 13 F6 FC 24 3C 02 B1 06 66 5B E6 9E 18 40 88 41 5B 27 39 99 B8 77 BE E3 53 A2 48 CE C7 EE B5 A0 95 C2 17 4B C9 52 6C AF E3 37 2C 59 DB FB E7 58 13 4E D3 51 E5 14 72 73 FE C6 85 77 AE 45 52 A6 F9 9A C8 0C A8 D0 EE 42 2A F5 28 85 8C 6B E8 1C B0 A8 03 1A B0 AE 83 C0 EB 55 64 F4 E8 7A 5C 06 29 5D 39 03 EE E2 FD F9 2D 62 A7 F4 D4 05 4D EA A7 9B CA EB DA 4E 8B 1A 6E FD 42 AE F9 D0 1C 70 75 72 8C B1 3A A8 55 7C 85 A7 25 32 B5 E2 D6 C3 E5 50 41 C9 86 7C A8 F5 62 BB D2 AB 0C 37 10 D8 31 73 EC 37 81 D1 DC AA C5 C6 E0 7E E7 26 62 4D FD C5 81 4C FF D3 36 E1 79 32 F8 9B EB 9C F7 FD BE E9 BE BF 61

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

2877000

trusted library allocation

page read and write

482000

unkown

page readonly

7680000

trusted library allocation

page read and write

3984000

trusted library allocation

page read and write

C5E000

stack

page read and write

3A51000

trusted library allocation

page read and write

65C0000

trusted library allocation

page read and write

389F000

trusted library allocation

page read and write

5981000

heap

page read and write

6571000

trusted library allocation

page read and write

7BF0000

trusted library allocation

page read and write

387E000

trusted library allocation

page read and write

743B000

heap

page read and write

4DD0000

heap

page execute and read and write

3825000

trusted library allocation

page read and write

658E000

trusted library allocation

page read and write

7790000

trusted library allocation

page execute and read and write

3A3A000

trusted library allocation

page read and write

C94000

trusted library allocation

page read and write

7649000

trusted library allocation

page read and write

63B2000

heap

page read and write

3A2F000

trusted library allocation

page read and write

2CAE000

trusted library allocation

page read and write

39C1000

trusted library allocation

page read and write

63CF000

heap

page read and write

4DF0000

trusted library allocation

page read and write

9EE000

heap

page read and write

73DA000

heap

page read and write

380F000

trusted library allocation

page read and write

534E000

stack

page read and write

3909000

trusted library allocation

page read and write

388F000

trusted library allocation

page read and write

3C31000

trusted library allocation

page read and write

5F6E000

stack

page read and write

65BE000

trusted library allocation

page read and write

5E0000

heap

page read and write

3902000

trusted library allocation

page read and write

639E000

heap

page read and write

7690000

trusted library allocation

page read and write

38A6000

trusted library allocation

page read and write

5D0000

heap

page read and write

7652000

trusted library allocation

page read and write

C9D000

trusted library allocation

page execute and read and write

6591000

trusted library allocation

page read and write

4B2000

unkown

page readonly

29B2000

trusted library allocation

page read and write

3BF2000

trusted library allocation

page read and write

ABD000

heap

page read and write

56A000

stack

page read and write

63DD000

heap

page read and write

4C6000

unkown

page readonly

767F000

trusted library allocation

page read and write

7770000

trusted library allocation

page read and write

4CE5000

trusted library allocation

page read and write

C1E000

stack

page read and write

7362000

heap

page read and write

A25000

heap

page read and write

6539000

trusted library allocation

page read and write

2A9A000

trusted library allocation

page read and write

2CBE000

trusted library allocation

page read and write

60C0000

trusted library allocation

page execute and read and write

FC6000

heap

page read and write

390E000

trusted library allocation

page read and write

6528000

trusted library allocation

page read and write

A22000

heap

page read and write

7320000

trusted library allocation

page read and write

5997000

heap

page read and write

382B000

trusted library allocation

page read and write

CC7000

heap

page read and write

490C000

stack

page read and write

2CA6000

trusted library allocation

page read and write

3A0B000

trusted library allocation

page read and write

66C0000

trusted library allocation

page execute and read and write

394C000

trusted library allocation

page read and write

4E00000

heap

page read and write

7427000

heap

page read and write

2993000

trusted library allocation

page read and write

3B93000

trusted library allocation

page read and write

39BE000

trusted library allocation

page read and write

F80000

trusted library allocation

page read and write

2A94000

trusted library allocation

page read and write

CC0000

heap

page read and write

4CE0000

trusted library allocation

page read and write

77DE000

stack

page read and write

65A0000

trusted library allocation

page read and write

689C000

stack

page read and write

3853000

trusted library allocation

page read and write

73DF000

heap

page read and write

4CA6000

trusted library allocation

page read and write

3A4A000

trusted library allocation

page read and write

3989000

trusted library allocation

page read and write

73AA000

heap

page read and write

656B000

trusted library allocation

page read and write

3928000

trusted library allocation

page read and write

4F60000

trusted library allocation

page read and write

391F000

trusted library allocation

page read and write

4B7000

unkown

page readonly

3BB9000

trusted library allocation

page read and write

4EEE000

stack

page read and write

4CC0000

trusted library allocation

page read and write

261E000

stack

page read and write

C80000

trusted library allocation

page read and write

7340000

heap

page read and write

2979000

trusted library allocation

page read and write

740F000

heap

page read and write

73C7000

heap

page read and write

3867000

trusted library allocation

page read and write

6600000

trusted library allocation

page read and write

6520000

trusted library allocation

page read and write

CBA000

trusted library allocation

page execute and read and write

7659000

trusted library allocation

page read and write

2CC4000

trusted library allocation

page read and write

4C9E000

trusted library allocation

page read and write

7655000

trusted library allocation

page read and write

4D70000

trusted library allocation

page execute and read and write

7398000

heap

page read and write

DCF000

stack

page read and write

3913000

trusted library allocation

page read and write

7C00000

trusted library allocation

page read and write

67F0000

trusted library allocation

page read and write

8F7000

stack

page read and write

AAB000

heap

page read and write

3A66000

trusted library allocation

page read and write

FB0000

trusted library allocation

page read and write

7540000

heap

page read and write

4D1E000

trusted library allocation

page read and write

3C1C000

trusted library allocation

page read and write

3846000

trusted library allocation

page read and write

CA0000

trusted library allocation

page read and write

5F5000

heap

page read and write

4CDE000

trusted library allocation

page read and write

397F000

trusted library allocation

page read and write

3BDC000

trusted library allocation

page read and write

37F2000

trusted library allocation

page read and write

39B2000

trusted library allocation

page read and write

F90000

trusted library allocation

page execute and read and write

6810000

trusted library allocation

page read and write

39F1000

trusted library allocation

page read and write

7675000

trusted library allocation

page read and write

777F000

trusted library allocation

page read and write

38BE000

trusted library allocation

page read and write

4C80000

trusted library allocation

page read and write

3A1D000

trusted library allocation

page read and write

2CE2000

trusted library allocation

page read and write

38D6000

trusted library allocation

page read and write

606F000

stack

page read and write

2986000

trusted library allocation

page read and write

F60000

trusted library allocation

page read and write

65B0000

trusted library allocation

page read and write

699C000

stack

page read and write

73BD000

heap

page read and write

6640000

trusted library allocation

page read and write

37D1000

trusted library allocation

page read and write

735E000

heap

page read and write

3816000

trusted library allocation

page read and write

772E000

stack

page read and write

3899000

trusted library allocation

page read and write

AD7000

heap

page read and write

6535000

trusted library allocation

page read and write

76D0000

trusted library allocation

page execute and read and write

4D50000

heap

page read and write

2728000

trusted library allocation

page read and write

7688000

trusted library allocation

page read and write

3BC0000

trusted library allocation

page read and write

735B000

heap

page read and write

6560000

trusted library allocation

page read and write

4F90000

heap

page read and write

C90000

trusted library allocation

page read and write

52CE000

stack

page read and write

63AF000

heap

page read and write

518F000

stack

page read and write

3A60000

trusted library allocation

page read and write

71EB000

stack

page read and write

399E000

trusted library allocation

page read and write

CB0000

trusted library allocation

page read and write

6AE3000

trusted library allocation

page read and write

3978000

trusted library allocation

page read and write

73FE000

heap

page read and write

38CA000

trusted library allocation

page read and write

7330000

heap

page read and write

3C12000

trusted library allocation

page read and write

530E000

stack

page read and write

2957000

trusted library allocation

page read and write

29AC000

trusted library allocation

page read and write

65BB000

trusted library allocation

page read and write

FA0000

heap

page execute and read and write

3C05000

trusted library allocation

page read and write

3A44000

trusted library allocation

page read and write

3A12000

trusted library allocation

page read and write

7550000

heap

page read and write

4DE0000

trusted library allocation

page read and write

27C0000

heap

page read and write

480000

unkown

page readonly

3B7C000

trusted library allocation

page read and write

63C9000

heap

page read and write

39BB000

trusted library allocation

page read and write

72ED000

stack

page read and write

3B9F000

trusted library allocation

page read and write

66B0000

trusted library allocation

page execute and read and write

69DE000

stack

page read and write

7650000

trusted library allocation

page read and write

766A000

trusted library allocation

page read and write

2A96000

trusted library allocation

page read and write

3BD2000

trusted library allocation

page read and write

8450000

heap

page read and write

3C17000

trusted library allocation

page read and write

4E03000

heap

page read and write

F62000

trusted library allocation

page read and write

4D60000

trusted library allocation

page read and write

6525000

trusted library allocation

page read and write

39AB000

trusted library allocation

page read and write

299A000

trusted library allocation

page read and write

38B5000

trusted library allocation

page read and write

39E5000

trusted library allocation

page read and write

3883000

trusted library allocation

page read and write

3BFF000

trusted library allocation

page read and write

7DAE000

stack

page read and write

7324000

trusted library allocation

page read and write

4CD0000

trusted library allocation

page read and write

3C0E000

trusted library allocation

page read and write

38F0000

trusted library allocation

page read and write

76A0000

trusted library allocation

page read and write

2CC1000

trusted library allocation

page read and write

3879000

trusted library allocation

page read and write

3940000

trusted library allocation

page read and write

2A8C000

trusted library allocation

page read and write

38B0000

trusted library allocation

page read and write

7440000

heap

page read and write

3A69000

trusted library allocation

page read and write

296C000

trusted library allocation

page read and write

3A5B000

trusted library allocation

page read and write

AD3000

heap

page read and write

6650000

trusted library allocation

page execute and read and write

FCE000

heap

page read and write

F67000

trusted library allocation

page execute and read and write

7EFD0000

trusted library allocation

page execute and read and write

A15000

heap

page read and write

381C000

trusted library allocation

page read and write

65E0000

trusted library allocation

page read and write

3A64000

trusted library allocation

page read and write

39FE000

trusted library allocation

page read and write

766F000

trusted library allocation

page read and write

3C09000

trusted library allocation

page read and write

2961000

trusted library allocation

page read and write

65B5000

trusted library allocation

page read and write

7352000

heap

page read and write

29CD000

trusted library allocation

page read and write

3A24000

trusted library allocation

page read and write

6530000

trusted library allocation

page read and write

651E000

stack

page read and write

5993000

heap

page read and write

5F2F000

stack

page read and write

39CE000

trusted library allocation

page read and write

A00000

heap

page read and write

6379000

heap

page read and write

638A000

heap

page read and write

7CAE000

stack

page read and write

CAD000

trusted library allocation

page execute and read and write

3BE8000

trusted library allocation

page read and write

7403000

heap

page read and write

7BEE000

stack

page read and write

7780000

heap

page read and write

4D62000

trusted library allocation

page read and write

7300000

trusted library allocation

page read and write

3A2A000

trusted library allocation

page read and write

4CA1000

trusted library allocation

page read and write

3872000

trusted library allocation

page read and write

3820000

trusted library allocation

page read and write

F6B000

trusted library allocation

page execute and read and write

4DE8000

trusted library allocation

page read and write

73E8000

heap

page read and write

62AE000

stack

page read and write

6537000

trusted library allocation

page read and write

9E0000

heap

page read and write

538E000

stack

page read and write

767A000

trusted library allocation

page read and write

62E9000

heap

page read and write

4C70000

trusted library allocation

page read and write

3C89000

trusted library allocation

page read and write

38C3000

trusted library allocation

page read and write

4CF0000

trusted library allocation

page read and write

383A000

trusted library allocation

page read and write

4CB2000

trusted library allocation

page read and write

2CD7000

trusted library allocation

page read and write

848B000

heap

page read and write

6B20000

trusted library allocation

page execute and read and write

3C14000

trusted library allocation

page read and write

2A8E000

trusted library allocation

page read and write

781E000

stack

page read and write

38F7000

trusted library allocation

page read and write

641E000

stack

page read and write

C93000

trusted library allocation

page execute and read and write

3BF8000

trusted library allocation

page read and write

396D000

trusted library allocation

page read and write

37DF000

trusted library allocation

page read and write

2CE8000

trusted library allocation

page read and write

6660000

trusted library allocation

page execute and read and write

2C33000

trusted library allocation

page read and write

5F0000

heap

page read and write

4C50000

heap

page read and write

CB2000

trusted library allocation

page read and write

76E0000

trusted library allocation

page read and write

67E0000

trusted library allocation

page read and write

271E000

stack

page read and write

3BD8000

trusted library allocation

page read and write

38BB000

trusted library allocation

page read and write

6582000

trusted library allocation

page read and write

736F000

heap

page read and write

3A6F000

trusted library allocation

page read and write

38E3000

trusted library allocation

page read and write

3A57000

trusted library allocation

page read and write

7346000

heap

page read and write

F65000

trusted library allocation

page execute and read and write

29C2000

trusted library allocation

page read and write

7EEE000

stack

page read and write

3994000

trusted library allocation

page read and write

39A5000

trusted library allocation

page read and write

7646000

trusted library allocation

page read and write

5E2F000

stack

page read and write

3833000

trusted library allocation

page read and write

2A90000

trusted library allocation

page read and write

6850000

trusted library allocation

page execute and read and write

4C8B000

trusted library allocation

page read and write

B1E000

stack

page read and write

FC0000

heap

page read and write

6630000

trusted library allocation

page read and write

5B6E000

stack

page read and write

776E000

stack

page read and write

734B000

heap

page read and write

62E0000

heap

page read and write

2A37000

trusted library allocation

page read and write

9F8000

heap

page read and write

39B5000

trusted library allocation

page read and write

2AAD000

trusted library allocation

page read and write

61AE000

stack

page read and write

51CE000

stack

page read and write

4CAD000

trusted library allocation

page read and write

53A0000

heap

page read and write

3959000

trusted library allocation

page read and write

4D10000

trusted library allocation

page read and write

6576000

trusted library allocation

page read and write

4C84000

trusted library allocation

page read and write

6830000

trusted library allocation

page execute and read and write

739E000

heap

page read and write

38B9000

trusted library allocation

page read and write

6372000

heap

page read and write

73F0000

heap

page read and write

29A5000

trusted library allocation

page read and write

AB1000

heap

page read and write

7640000

trusted library allocation

page read and write

27D1000

trusted library allocation

page read and write

39C9000

trusted library allocation

page read and write

6ADC000

stack

page read and write

3BCB000

trusted library allocation

page read and write

382E000

trusted library allocation

page read and write

65D0000

trusted library allocation

page read and write

3C59000

trusted library allocation

page read and write

38AC000

trusted library allocation

page read and write

39C3000

trusted library allocation

page read and write

7AEE000

stack

page read and write

6820000

trusted library allocation

page read and write

29B7000

trusted library allocation

page read and write

652A000

trusted library allocation

page read and write

2921000

trusted library allocation

page read and write

480C000

stack

page read and write

65F0000

trusted library allocation

page read and write

6800000

trusted library allocation

page read and write

3966000

trusted library allocation

page read and write

3829000

trusted library allocation

page read and write

3BAC000

trusted library allocation

page read and write

A07000

heap

page read and write

7668000

trusted library allocation

page read and write

72F0000

trusted library allocation

page execute and read and write

2A13000

trusted library allocation

page read and write

6AE0000

trusted library allocation

page read and write

6327000

heap

page read and write

53B0000

trusted library allocation

page execute and read and write

6B10000

trusted library allocation

page read and write

7387000

heap

page read and write

3A73000

trusted library allocation

page read and write

3860000

trusted library allocation

page read and write

599B000

heap

page read and write

7DEE000

stack

page read and write

CB6000

trusted library allocation

page execute and read and write

There are 374 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
G4jZEW68K1.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportG4jZEW68K1.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
G4jZEW68K1.exe